Not a solution for shared multi factor auth but maybe some ideas…
- the root account should not be used. Disable it from being able to do anything with an SCP
- new accounts created with aws organisations by default have a random password and no mfa. Access is granted by going through the password reset process. Switch to this process for existing accounts, randomise all the passwords, grant break glass access via password resetting (ensure your contact details are valid). The password reset typically requires access to the email account (make it accessible via SSO) and potentially a phone call, ensure a virtual phone number is used and root holders can point it at their phone.
- use the likes of azure ad, keycloak or okta to store your organisations identities. Require MFA on them via yubikey. Enable access to multiple aws accounts via aws sso.
Sad, frustrated, bitter & angry to have been apart of this. Started the job on April 4th, casual 1:1 with my manager on May 26th turned into HR stating it’s over. Not even one months severance as a good will gesture.
Why does bad planning on your part need to result in stress, anxiety, and financial concern for me?
The market is thankfully in a good place and I’m good at what I do. Did atleast one interview activity with 20+ places, it was hell, busier than a average work day. To get to final around it took 6-8 hours of interview activities.
It would be amazing to see companies that are struggling to hire to create a fast tracked interview process for those laid off.
My bet is you could remove the user. Do some DNS messing about either on your router or hosts file to drop all communications to goguardian and then resign into your sons account.
The end result will be that the school management scripts will still run but they’ll be unable to fetch and install goguardian.
The demod used case is a silly one that makes zero sense, but instead of asking why, think, what else is possible.
For most peoeple the act of brushing their teeth marks waking up or going to bed.
With such data exposed and combined with timing data you could trigger morning or night time routines. For example, the toothbrush transitioning from running -> idle after 8pm and before 4am could cause the bedroom to go into sleep lighting (gold at 40% fading out over 15 minutes), all other lights to be turned off, all smart plugs turned off, house alarm set to armed, heating turned off and so on..... or I could just continue to be silly and turn it into a TV controller https://twitter.com/imduffy15/status/1256954852996939777
Can help fill in some of the blanks for you. The toothbrush has bluetooth. Its bluetooth advertisement contains information about its operating state (running, idle, etc.), mode (brush, daily clean, etc.), pressure and some other things.
The ESP32 chip scans bluetooth, detectes these advertisements, parses them and extras the data. It then sends it over to home-assistant.io which can use the data to trigger actions on any other connected device.
Having the pods service account token passed to the credential provider allows for seamless authentication with private registries.
Before you either had to use the node identity which in some cases isn’t oidc based or create a bunch of imagePullSecrets.
Code and walkthrough at https://github.com/cloudsmith-io/cloudsmith-kubernetes-crede...